我的博客已迁移到xdoujiang.com请去那边和我交流
一、基础环境
1、fail2ban可以监视你的系统日志，然后匹配日志的错误信息（正则式匹配）执行相应的屏蔽动作
（一般情况下是调用防火墙屏蔽），如:当有人在试探你的SSH、SMTP、FTP密码，只要达到你预设的次数，
fail2ban就会调用防火墙屏蔽这个IP，而且可以发送e-mail通知系统管理员，是一款很实用、很强大的软件！
2、版本
cat /etc/debian_version
7.4
3、ip
10.131.172.202
二、安装fail2ban
1、apt或dpkg安装
apt-get -y install fail2ban
或
dpkg -i fail2ban_0.8.6-3wheezy3_all.deb
PS:下载地址
http://ftp.cn.debian.org/debian/pool/main/f/fail2ban/fail2ban_0.8.6-3wheezy3_all.deb
2、查看配置
ll /etc/fail2ban/
drwxr-xr-x 2 root root 4096 Jun 19 14:15 action.d
-rw-r--r-- 1 root root 853 Nov 29 2011 fail2ban.conf
drwxr-xr-x 2 root root 4096 Jun 19 15:43 filter.d
-rw-r--r-- 1 root root 7347 Jun 19 15:51 jail.conf
3、修改配置支持ssh和apache
cat /etc/fail2ban/jail.local(PS:这个配置文件一定是以.local结尾的)
[DEFAULT]
ignoreip = 127.0.0.1/8 172.31.0.0/24 10.0.0.0/8 192.168.0.0/24
bantime = 86400
maxretry = 10
findtime = 600
[ssh-iptables]
enabled = true
port = 55000
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
[apache]
enabled = true
port = 80,443
filter = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 6
[apache-noscript]
enabled = true
port = 80,443
filter = apache-noscript
logpath = /var/log/apache*/*error.log
maxretry = 6
[apache-overflows]
enabled = true
port = 80,443
filter = apache-overflows
logpath = /var/log/apache*/*error.log
maxretry = 2
[apache-nohome]
enabled = true
port = 80,443
filter = apache-nohome
logpath = /var/log/apache*/*error.log
maxretry = 2
PS:我这里ssh端口是55000 apache是80
netstat -tupnl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:55000 0.0.0.0:* LISTEN 29921/sshd
tcp 0 0 127.0.0.1:9898 0.0.0.0:* LISTEN 30949/barad_agent
tcp6 0 0 :::80 :::* LISTEN 3964/apache2
tcp6 0 0 :::55000 :::* LISTEN 29921/sshd
4、重启服务
/etc/init.d/fail2ban restart
[ ok ] Restarting authentication failure monitor: fail2ban.
5、查看日志
2015-06-19 22:06:37,139 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.6
2015-06-19 22:06:37,140 fail2ban.jail : INFO Creating new jail 'apache'
2015-06-19 22:06:37,140 fail2ban.jail : INFO Jail 'apache' uses Gamin
2015-06-19 22:06:37,149 fail2ban.filter : INFO Added logfile = /var/log/apache2/svn_error.log
2015-06-19 22:06:37,150 fail2ban.filter : INFO Set maxRetry = 6
2015-06-19 22:06:37,151 fail2ban.filter : INFO Set findtime = 600
2015-06-19 22:06:37,151 fail2ban.actions: INFO Set banTime = 86400
2015-06-19 22:06:37,154 fail2ban.jail : INFO Creating new jail 'apache-noscript'
2015-06-19 22:06:37,154 fail2ban.jail : INFO Jail 'apache-noscript' uses Gamin
2015-06-19 22:06:37,155 fail2ban.filter : INFO Added logfile = /var/log/apache2/svn_error.log
2015-06-19 22:06:37,155 fail2ban.filter : INFO Set maxRetry = 6
2015-06-19 22:06:37,156 fail2ban.filter : INFO Set findtime = 600
2015-06-19 22:06:37,157 fail2ban.actions: INFO Set banTime = 86400
2015-06-19 22:06:37,161 fail2ban.jail : INFO Creating new jail 'apache-overflows'
2015-06-19 22:06:37,161 fail2ban.jail : INFO Jail 'apache-overflows' uses Gamin
2015-06-19 22:06:37,161 fail2ban.filter : INFO Added logfile = /var/log/apache2/svn_error.log
2015-06-19 22:06:37,162 fail2ban.filter : INFO Set maxRetry = 2
2015-06-19 22:06:37,163 fail2ban.filter : INFO Set findtime = 600
2015-06-19 22:06:37,163 fail2ban.actions: INFO Set banTime = 86400
2015-06-19 22:06:37,166 fail2ban.jail : INFO Creating new jail 'ssh-iptables'
2015-06-19 22:06:37,167 fail2ban.jail : INFO Jail 'ssh-iptables' uses Gamin
2015-06-19 22:06:37,167 fail2ban.filter : INFO Added logfile = /var/log/auth.log
2015-06-19 22:06:37,167 fail2ban.filter : INFO Set maxRetry = 5
2015-06-19 22:06:37,169 fail2ban.filter : INFO Set findtime = 600
2015-06-19 22:06:37,169 fail2ban.actions: INFO Set banTime = 86400
2015-06-19 22:06:37,188 fail2ban.jail : INFO Creating new jail 'apache-nohome'
2015-06-19 22:06:37,188 fail2ban.jail : INFO Jail 'apache-nohome' uses Gamin
2015-06-19 22:06:37,189 fail2ban.filter : INFO Added logfile = /var/log/apache2/svn_error.log
2015-06-19 22:06:37,189 fail2ban.filter : INFO Set maxRetry = 2
2015-06-19 22:06:37,190 fail2ban.filter : INFO Set findtime = 600
2015-06-19 22:06:37,191 fail2ban.actions: INFO Set banTime = 86400
2015-06-19 22:06:37,194 fail2ban.jail : INFO Jail 'apache' started
2015-06-19 22:06:37,196 fail2ban.jail : INFO Jail 'apache-noscript' started
2015-06-19 22:06:37,197 fail2ban.jail : INFO Jail 'apache-overflows' started
2015-06-19 22:06:37,198 fail2ban.jail : INFO Jail 'ssh-iptables' started
2015-06-19 22:06:37,200 fail2ban.jail : INFO Jail 'apache-nohome' started
6、查看iptables已经生效了
iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-apache-nohome tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
fail2ban-ssh-iptables tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 55000
fail2ban-apache-overflows tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
fail2ban-apache-noscript tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
fail2ban-apache tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-apache (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-apache-nohome (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-apache-noscript (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-apache-overflows (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-ssh-iptables (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
7、使用fail2ban-client命令查看状态
fail2ban-client status
Status
|- Number of jail: 5
- Jail list: apache, apache-overflows, apache-nohome, apache-noscript, ssh-iptables
8、更细致的查看某个项
fail2ban-client status ssh-iptables
Status for the jail: ssh-iptables
|- filter
| |- File list: /var/log/auth.log
| |- Currently failed: 0
| `- Total failed: 0
`- action
|- Currently banned: 0
| `- IP list:
`- Total banned: 0
9、将服务加入到开机启动
update-rc.d fail2ban defaults
update-rc.d: using dependency based boot sequencing
10、查看下日志轮询信息
cat /etc/logrotate.d/fail2ban
/var/log/fail2ban.log {
weekly
rotate 4
compress
delaycompress
missingok
postrotate
fail2ban-client set logtarget /var/log/fail2ban.log >/dev/null
endscript
# If fail2ban runs as non-root it still needs to have write access
# to logfiles.
# create 640 fail2ban adm
create 640 root adm
}
三、参考文章
http://xmodulo.com/how-to-protect-ssh-server-from-brute-force-attacks-using-fail2ban.html
https://linux.cn/article-5068-qqmail.htmlfail2ban安装及使用(debian)
精选 原创文章标签 iptables fail2ban de 文章分类 开源
©著作权归作者所有：来自51CTO博客作者xdoujiang的原创作品，请联系作者获取转载授权，否则将追究法律责任
上一篇：shell脚本日志清理和压缩
下一篇：shell的单、多、控制进程
提问和评论都可以，用心的回复会被更多人看到
评论
发布评论
相关文章
-
fail2ban安装与使用
fail2ban安装与使用
fail2ban 安装 使用 -
实战 fail2ban 安装
实战 fail2ban 安装
fail ban -
Fail2Ban之python
http://lilinji.blog.51cto.com/5441000/1784726
Fail2Ban之python -
odoo 结合fail2ban
在配置fail2ban的时候遇到很多坑,现在记录下 先参考一篇博客的教程: https://atjason
odoo 服务器 nginx 数据库 -
fail2ban 的安装配置
防暴力破解SSH fail2ban
fail 防暴力
